Pug’s Place

This is a 11-meg QuickTime movie made by an ad-company as part of their demo-reel but never aired on TV. I think it’s absolutely hilarious, in many demented ways. It’s definitely original! You should take a peek… just make sure you’re not drinking anything.

Scott Kurtz linked this on PvP’s news, just FYI.

I just did my e-file tax return online with H&R Block, and it was actually quite painless. It took 30 minutes, and I get my money back. Yay! So if you go through the IRS to do your e-file and they point you to a private company, know that H&R Block doesn’t suck.

I’m back in town. My weekend was highly enjoyed! On top of that, next weekend starts Spring Break! Booyah!

And Spring Break will find me in Arizona and Nevada, so I’m totally happy. I’ll even be visiting a University of Florida telescope, and the Kitt Peak observatory. Whee!

Maybe I’ll get to eat at Espos?

This XMMS plugin is AWESOME. It’s a database-driven playlist plugin for XMMS that sits there and learns your music taste and likes/dislikes… and then it adapts the shuffle of your playlist to play songs that you like more often than songs you don’t like.

It’s fair, too. Even unfavored songs have a (small) chance of being played.

My playlist has over 2100 songs on it, so this plugin is awesome for me. It makes the random shuffling random in ways that I like! While AC/DC is still on my playlist, it won’t show up very often since I rarely listen to AC/DC songs (except Hell’s Bells… That song’s just cool…).

If you use XMMS, you should try out this plugin. It’s just a plugin, no patching. The only dependencies are XMMS (duh) and SQLlite.

It’s odd. I have this muscle at the base of my hand, where it joins with the wrist that’s going bloody insane today. It’s bloody painful! I don’t generally complain about wrist pain, but this is simply annoying - I’ve dropped stuff because of muscle spasms in my hand, and I nearly ran into a wall on my bike because my hand caused a spasm of the muscles up my right forearm…

It’s really weird. I can’t find any bunched or knotted muscles, nor bruising. Oh well.

I’ll be out of town for the weekend; running up to Fort Walton Beach for tomorrow and Saturday, to return Sunday. I’ll be leaving here before first light tomorrow morning, so don’t expect to see me online.

Most of my homework for the weekend is done, so I should be mostly stress free coming back on Sunday. That’s always worth it.

Now I must go off to my last class for the day, and for this week. Woo!

A: They were both accepted to FSU.

What have I been up to? Let’s see:

• Played D&D with Theresa and James on Saturday
• Took my first digital logic exam Tuesday night
• Read Mostly Harmless
• Wrote a manual for “Building an Effective Anti-Spam Solution” [PDF] for Speaking and Writing for Engineers. It doesn’t follow their guidelines very well, but I think it’s much better my way. Considering my way is now becoming a documentation standard at my company, hey…
• Reading Applied Cryptography
• Started putting together needed stuff to do off-my-head Dungeon Mastering for D&D

Yeah. Anyway, mostly I’ve just been doing homework and studying. I want to have as little stress Sunday evening and Monday morning as possible.

I also posted very silencing sort of message to the Student Honors Organization mailing list this morning on the subject of Outlook and Outlook Express, and malicious e-mails. You might find it informative and amusing… so I’ll close with a copy of it:

On Wed, 2004-02-25 at 01:15, Karolina Ocipka wrote:

Rik, The only thing that I found in outlook was,
that it downloads the messages automatically into the preview pane. To turn
this off, go to Tools/Options choose the Read pane and then uncheck the
"Automatically download messages when viewing in the PreviewPane".
That should prevent any kind of unwanted downloading ofmessages, other than
that I don’t believe outlook opensattachments on its own. Hope that helps,




Outlook seems to have an unending list of security vulnerabilities that allow attachments to automatically, without any user intervention other than "previewing" or "viewing" a message, execute arbitrary (read: possibly malicious) code.

As each one is identified, it’s slowly fixed.

As for some proof behind my claims that Outlook and Outlook Express are bug-ridden security nightmares that are constantly finding new ways to execute malicious code without your consent, please refer to the following helpful table that I just put together, complete with hyper-links to Security Focus entries.

Please note, this is in no way a comprehensive list. I’m not dedicated enough to go and find a comprehensive one. This list contains all known vulnerabilities that have not yet been completely fixed. If it’s on this list, it’s still exploitable.

Note that Outlook Express and Outlook are also vulnerable to most (not all, but most) Internet Explorer vulnerabilities, due to their close integration. I did not include any Internet Explorer vulnerabilities in this list. It would have doubled in size.

Some non-factual opinions and suggestions for *MUCH* better, free email clients follow the table.

Date	Outstanding Vulnerability
2004-02-20:	Multiple Outlook/Outlook Express Predictable File Location Weaknesses
2004-02-16:	Microsoft Outlook Express Arbitrary Program Execution Vulnerability
2004-02-10:	Microsoft Internet Explorer Double-Null URI Denial Of Service Vulnerability
2004-02-02:	Multiple Browser URI Display Obfuscation Weakness
2003-11-11:	Multiple Vendor Invalid X.509 Certificate Chain Vulnerability
2003-10-04:	Microsoft Internet Explorer Absolute Position Block Denial Of Service Vulnerability
2003-09-02:	Microsoft mshtml.dll Library GIF Image Handling Denial of Service Vulnerability
2003-07-25:	Microsoft Outlook Express Script Execution Weakness
2003-06-01:	Multiple IMAP Client Integer Overflow Vulnerabilities
2003-04-23:	Microsoft Outlook Express MHTML URL Handler File Rendering Vulnerability
2003-02-28:	Microsoft Outlook and Outlook Express Arbitrary Program Execution Vulnerability
2003-02-10:	Multiple Vendor Email Client JavaScript Information Leakage Vulnerability
2003-01-29:	Microsoft Outlook Express S/MIME Buffer Overflow Vulnerability
2003-01-22:	Microsoft Outlook 2002 V1 Exchange Server Security Certificate Information Leakage Vulnerability
2002-12-04:	Microsoft Outlook 2002 Email Header Processing Denial of Service Vulnerability
2002-09-09:	Alleged Outlook Express Link Denial of Service Vulnerability
2002-07-29:	Microsoft Outlook Express XML File Attachment Script Execution Vulnerability
2002-07-21:	Microsoft Outlook Express Spoofable File Extensions Vulnerability
2002-07-19:	Microsoft Outlook Express SMTP Over TLS Information Disclosure Vulnerability
2002-04-26:	Microsoft Outlook HTML Mail Script Execution Vulnerability
2002-04-24:	Microsoft Outlook Express DOS Device Denial of Service Vulnerability
2002-04-09:	Microsoft VBScript ActiveX Word Object Denial Of Service Vulnerability
2002-03-22:	Microsoft Outlook Disabled Cookies Setting Bypass Vulnerability
2002-03-22:	Microsoft Outlook IFrame Embedded Media Player File Vulnerability
2002-03-21:	Microsoft Outlook Javascript Execution Vulnerability
2002-03-21:	Microsoft Outlook IFrame Embedded URL Vulnerability
2002-02-13:	Outlook Express Attachment Carriage Return/Linefeed Encapsulation Filtering Bypass Vulnerability
2002-02-07:	Multiple Vendor HTML Form Protocol Vulnerability
2001-09-12:	Microsoft Outlook Express 6 Plain Text Message Script Execution Vulnerability
2001-08-17:	Microsoft Outlook Arbitrary Code Execution Vulnerability
2001-08-15:	Microsoft MSHTML.DLL Crash Vulnerability
2001-07-13:	Microsoft Outlook Unauthorized Email Access Vulnerability
2001-06-05:	Microsoft Outlook Express Address Book Spoofing Vulnerability
2001-05-15:	Microsoft IE and OE XML Stylesheets Active Scripting Vulnerability
2001-03-11:	Microsoft Outlook vcard Buffer Overflow Vulnerability
2001-01-22:	Microsoft Outlook Concealed Attachment Vulnerability
2000-07-18:	Microsoft Outlook / Outlook Express GMT Field Buffer Overflow Vulnerability
2000-05-12:	Microsoft Outlook 98 / Outlook Express 4.x Long Filename Vulnerability
2000-02-19:	Microsoft Signed ActiveX Active Setup Vulnerability
1999-11-08:	="http://www.securityfocus.org/bid/775"> Microsoft ActiveX CAB File Execution Vulnerability
1999-06-01:	Outlook Express POP Denial of Service Vulnerability
1999-06-01:	Multiple Vendor Buffer Overflow in MIME-aware Mail and News Clients Vulnerability

My opinion that is not backed up by a long list of evidence:

Outlook and Outlook Express are easily the World’s Worst (Graphical) Email Clients. Sure, they look pretty and do some nifty things. I’ve used Ximian Evolution for two years now, and it has every feature Outlook has, yet it’s track record for security is sterling, with fixes being posted within hours of a possible problem being identified. There are only a couple of vulnerabilities out there for Evolution, and all of them are for versions more than a year old. Did I mention that Evolution is free software?

http://ximian.com/products/evolution/

Another wonderful mail client is Mozilla Thunderbird. It has built-in Bayesian spam filtering (and is VERY good after a week of learning), is slick, secure and fast. With the Enigmail extension it has full integration with GnuPG for cryptographically secure email. And on top of that, it works perfectly on Windows.

More info: http://www.mozilla.org/thunderbird/

With excellent commercial-grade free software like Mozilla Thunderbird available on the Internet for no cost, it always bewilders me how people suffer with expensive and sub-standard programs like Outlook Express and even, to an extent, Outlook.

Even if you believe I’m a crackpot, just check out Thunderbird. It’s probably better than what you’re using, and it won’t automatically mail the next virus to everyone on your address book for the sake of being friendly.


My apologies that this email is in HTML format; it was needed for the pretty hyper-links in the above table.

I’m always more than happy to chat about computer security. If anyone’s interested, feel free to give me an email off the listserv at the above address.

Cheers,

– James ‘J.C.’ Jones
"No trees were killed in the creation of this message.
However, many electrons were terribly inconvenienced."
  - Anonymous

PS: Does it annoy anyone else that this listserv rejects    messages that have a GPG/PGP digital signature? RAR!

Rule One:

If you pull into my driveway and honk you’d better be delivering a package, because you’re sure not picking anything up.

Rule Two:

You do not touch my daughter in front of me. You may glance at her, so long as you do not peer at anything below her neck. If you cannot keep your eyes or hands off of my daughter’s body, I will remove them.

Rule Three:

I am aware that it is considered fashionable for boys of your age to wear their trousers so loosely that they appear to be falling off their hips. Please don’t take this as an insult, but you and all of your friends are complete idiots. Still, I want to be fair and open minded about this issue, so I propose his compromise: You may come to the door with your underwear showing and your pants ten sizes too big, and I will not object. However, in order to ensure that your clothes do not, in fact, come off during the course of your date with my daughter, I will take my electric nail gun and fasten your trousers securely in place to your waist.

Rule Four:

I’m sure you’ve been told that in today’s world, sex without utilizing a “barrier method” of some kind can kill you. Let me elaborate, when it comes to sex, I am the barrier, and I will kill you.

Rule Five:

It is usually understood that in order for us to get to know each other, we should talk about sports, politics, and other issues of the day. Please do not do this. The only information I require from you is an indication of when you expect to have my daughter safely back at my house, and the only word I need from you on this subject is “early.”

Rule Six:

I have no doubt you are a popular fellow, with many opportunities to date other girls. This is fine with me as long as it is okay with my daughter. Otherwise, once you have gone out with my little girl, you will continue to date no one but her until she is finished with you. If you make her cry, I will make you cry.

Rule Seven:

As you stand in my front hallway, waiting for my daughter to appear, and more than an hour goes by, do not sigh and fidget. If you want to be on time for the movie, you should not be dating. My daughter is putting on her makeup, a process that can take longer than painting the Golden Gate Bridge. Instead of just standing there, why don’t you do something useful, like changing the oil in my car?

Rule Eight:

The following places are not appropriate for a date with my daughter: Places where there are beds, sofas, or anything softer than a wooden stool. Places where there are no parents, policemen, or nuns within eyesight. Places where there is darkness. Places where there is dancing, holding hands, or happiness. Places where the ambient temperature is warm enough to induce my daughter to wear shorts, tank tops, midriff T-shirts, or anything other than overalls, a sweater, and a goose down parka - zipped up to her throat. Movies with a strong romantic or sexual theme are to be avoided; movies which features chain saws are okay. Hockey games are okay. Old folks homes are better.

Rule Nine:

Do not lie to me. I may appear to be a potbellied, balding, middle-aged, dimwitted has-been. But on issues relating to my daughter, I am the all-knowing, merciless god of your universe. If I ask you where you are going and with whom, you have one chance to tell me the truth, the whole truth and nothing but the truth. I have a shotgun, a shovel, and five acres behind the house. Do not trifle with me.

Rule Ten:

Be afraid. Be very afraid. It takes very little for me to mistake the sound of your car in the driveway for a chopper coming in over a rice paddy near Hanoi. When my Agent Orange starts acting up, the voices in my head frequently tell me to clean the guns as I wait for you to bring my daughter home. As soon as you pull into the driveway you should exit your car with both hands in plain sight. Speak the perimeter password, announce in a clear voice that you have brought my daughter home safely and early, then return to your car - there is no need for you to come inside. The camouflaged face at the window is mine.

I’ve figured out how to get my numlock light to blink me morse code listings of data.

In honor of that, written above is Gates’ Law:

“Every 18 months, the speed of software halves.”

A couple things before I get to studying. Slashdot posted an article this morning about New Mexico’s House of Representatives passing a bill that would require every car sold in the state to be equipped with an ignition interlock breathalizer. So every person would be considered guilty of drunk driving and would have to make a 30-second breath test to start their car, and random 30-second breath tests while driving or face their car’s horn and headlights flashing until the vehicle stops.

Well, besides that being ethically wrong, I ran across a very nicely written comment that points out that Mothers Against Drunk Driving are raving lunatics (my opinion after reading through his evidence). Well, if not raving lunatics, then at least they are another evil special interest group trying to tell me how to live my life (and I’m even a happy teetotaler!).

If I can’t drive my car because I recently brushed my teeth and rinsed with Scope, I’d be seriously pissed.

Besides, I’d buy a bloody billows and put a kazoo in it to make the href="http://www.ignition-interlock.com/waquest.htm#PRODUCT%20AND%20DESIGN%20FEATURES">stupid
“Hum Tone”. Then I’d maybe even sell the things on the Internet to oppose
the law. It’s a bad and unethical idea, and MADD needs their href="http://www.ridl.us/pdf_stats/index.html">statistical lying revealed
in national press (here’s a group trying to do
just that).

On a more positive note, I found a link to a guide titled “Learn Writing with Uncle Jim” about how to write a novel. I’ve found the first page of the thread interesting, but that’s all I’ve read so far. Too many other things to do. However, by posting the link here, I’ll always be able to search my site and find the link again! Ingenious!